SOC 2 resource hub
The SOC 2 guide library: from first question to annual report.
Everything you need to understand, scope and prepare for a SOC 2 attestation, grouped by where you are. Start with the basics, choose your Trust Services Criteria, run the engagement, read the report, and use it to win deals. Each guide is written in plain words, with the key terms highlighted.
Back to SOC 2 services01 · Start here
Start here
If SOC 2 is new to you, these six guides cover the essentials.
- BasicsWhat is SOC 2?The attestation, the five categories, Type 1 vs Type 2, in plain words.
- Buyer questionIs there a SOC 2 certificate?No. What to say instead, and how to verify a vendor's claim.
- ComparisonSOC 2 Type 1 vs Type 2Snapshot or period, the observation window, and moving between them.
- ComparisonSOC 2 vs ISO 27001One access review followed through both audits, and what each reviewer asks.
- ComparisonSOC 1 vs SOC 2 vs SOC 3Who asks for each report, how the three differ, and when you need two.
- Buyer questionWho can sign a SOC 2 report?Only a licensed CPA firm, independent of whoever built your controls.
- BasicsA SOC 2 attestation, explainedWhat an attestation is, who may give one, and what you may call the result.
- Buyer questionYour first framework: SOC 2 or ISO 27001?A decision path by market, buyer and team.
02 · The 5 Trust Services Criteria
The five Trust Services Criteria
Security is in every report; the other four follow your commitments. One page for each category.
- OverviewTrust Services CriteriaThe five categories, with CC1 to CC9 read as questions your controls answer.
- RequiredThe Security category, criterion by criterionCC1 to CC9 in plain words, with the evidence each invites.
- OptionalThe Availability categoryA1.1 to A1.3: capacity, protection and tested recovery.
- OptionalThe Confidentiality categoryC1.1 and C1.2: identifying, protecting and disposing of confidential data.
- OptionalThe Processing Integrity categoryPI1.1 to PI1.5: complete, valid, accurate and timely processing.
- OptionalThe Privacy categoryP1 to P8: notice, choice, collection, use, access, disclosure, quality, monitoring.
- Decision guidePicking categories beyond SecurityWhich of the five categories your customers actually need.
03 · Scope
Scope and the system boundary
What the report covers, what it carves out, and who owes which controls.
- Technical referenceScope & the system boundaryWhat's in, what's carved out, and the CUECs your customers own.
- Technical referenceHosting on a SOC 2 cloud: what you inheritWhat a provider's report covers, and the controls that stay yours.
- Technical referenceCarve-out or inclusive: how vendors appear in your reportTwo ways to present a vendor, and what each does to your report.
- Technical referenceConfidentiality and Privacy: the pair people confuseCompany data against personal information, and when each applies.
- Technical referenceSeveral products, one report?Drawing a system boundary when you sell more than one product.
- Technical referenceSubservice organizations: vendors inside your reportWho counts, how they're monitored, and what the report must say.
- Technical referenceComplementary controls: what customers and vendors owe the systemCUECs and CSOCs, written so they can actually be checked.
- Technical referenceWriting the system descriptionA drafting workflow for the description, from facts to a review loop.
- Technical referenceThe SOC 2 controls listNo official list. Example controls grouped by the team that owns them.
04 · Running the engagement
Running the engagement
Everything between scoping and the CPA firm's report, and the years after.
- Interactive toolSOC 2 scope emulatorSwitch your commitments and data on and off; see which categories they pull in.
- RoadmapSOC 2 timeline & roadmapThe seven phases from scoping to the annual cycle.
- ChecklistSOC 2 audit preparationThe auditor's request list, complete populations, and a dry run before fieldwork.
- PlanningSOC 2 on a small teamWhat you can simplify, and what no team size excuses.
- PlanningChanging systems mid-auditHow the observation period copes with migrations, tools and people.
- PlanningFrom a Type 1 report to a Type 2What carries over, what is tested again, and what to start logging.
- PlanningThe readiness assessment, step by stepWhat it produces, what it doesn't, and how to use the result.
- PlanningWho owns each SOC 2 controlA role map from engineering to HR to leadership.
- PlanningChoosing the length of the observation periodThe trade-offs between a short and a long Type 2 window.
- ChecklistSOC 2 compliance checklistChecks grouped by who has to act, with the record that proves each.
- PlanningTen SOC 2 pitfallsThe predictable mistakes in scoping, the period and fieldwork.
- Technical referenceSampling & deviationsPopulations first, how samples are picked, and what one miss means.
- Technical referencePen tests & recovery testsNo criterion demands either. Your own control wording does.
- Technical referenceAn incident during the periodWhy an incident is not automatically an exception, and what to disclose.
- PlanningContinuous monitoring & year twoMonitoring as a criterion, a calendar of control frequency, and early signs of drift.
05 · Evidence & testing
Evidence and testing
What auditors accept, and the tests that create evidence.
- Technical referencePenetration testing for SOC 2What auditors look for in a test report, and what they ignore.
- Technical referenceBackup and recovery tests that satisfy SOC 2Designing a test an auditor can sample and trust.
- Technical referenceEvidence that passesWhat makes an item acceptable: source, date, completeness, owner.
- Technical referenceSampling & deviationsPopulations first, how samples are picked, and what one miss means.
- Technical referencePen tests & recovery testsNo criterion demands either. Your own control wording does.
- Technical referenceAn incident during the periodWhy an incident is not automatically an exception, and what to disclose.
06 · The report
The report itself
How a SOC 2 is built, who writes each part, and how to judge one.
- Technical referenceHow to read a SOC 2 reportFive questions to ask of any report, and where each answer sits.
- Technical referenceOpinions & exceptionsThe path from one failed sample up to the opinion a report carries.
- Buyer questionDoes SOC 2 mean you are secure?Reasonable assurance, what the report proves, and what it doesn't.
- Interactive toolSOC 2 report X-rayClick through a sample report: 18 markers, one question each.
- Technical referenceInside a SOC 2 report, section by sectionWho writes each section, and what each one is for.
- Technical referenceAuditor independenceThe line between helping you and auditing you.
- Technical referenceThe management assertionWhat leadership is signing, and what backs it.
- Technical referenceChoosing a CPA firm for SOC 2Qualifications, peer review, and the questions worth asking.
- Technical referenceA scorecard for a vendor's SOC 2 reportTen checks that tell a useful report from a thin one.
- Technical referenceCan a firm outside the US issue a SOC 2?CPA licensing and affiliation, with India as the worked case.
- Technical referenceGetting a SOC 2 as a company based in IndiaWhat changes, what doesn't, and how to choose the examiner.
07 · Using it commercially
Using SOC 2 commercially
Describing it accurately, keeping it current, and sharing it.
- Buyer questionSOC 2 and security questionnairesWhat each one settles, and how to answer without repeating yourself.
- Buyer questionHow long a SOC 2 report stays usefulThe age buyers accept, and what to do when yours ages out.
- Buyer questionSOC 2 bridge lettersWhat a bridge letter says, who signs it, and its limits.
- Buyer questionYour second SOC 2: renewal and the continuous cycleBack-to-back periods, what year two repeats, and what it adds.
- Buyer question“SOC 2 in progress”: what you can honestly sayWording that is true at each stage, and wording to avoid.
- Buyer questionIs there a SOC 2 certificate?No. What to say instead, and how to verify a vendor's claim.
- Buyer questionSharing your SOC 2 reportRestricted use, NDAs, prospects, and when a SOC 3 fits.
- PlaybookSOC 2 in sales & questionnairesWhat the report answers, what it can't, and what to say mid-journey.
- Technical referenceDo your vendors need SOC 2?Tier vendors by reach, and accept the right evidence per tier.
- ComparisonSOC 2 and GDPR, HIPAA, DPDPWhere SOC 2 overlaps each law, and where it stops.
08 · By industry
SOC 2 for your industry
The framework is the same; what buyers press on differs. One page per sector.
- OverviewSOC 2 by industryWhat twelve sectors usually scope in, and what gets scrutinised.
- IndustrySOC 2 for SaaS and cloud companiesMulti-tenant data, the shared stack, and what buyers ask first.
- IndustrySOC 2 for fintechMoney movement, partner banks and processing integrity.
- IndustrySOC 2 for AI companiesTraining data, model providers and customer prompts.
- IndustrySOC 2 for healthtechWhere SOC 2 sits beside HIPAA, and the categories it leans on.
- IndustrySOC 2 for e-commerce platformsMerchant data, payment flows and peak-load availability.
- IndustrySOC 2 for MSPs and IT service providersPrivileged access into other people's systems.
- IndustrySOC 2 for edtechStudent data, school buyers and consent.
- IndustrySOC 2 for HR and payroll techEmployee records, payroll accuracy and access separation.
- IndustrySOC 2 for consulting and professional servicesClient data held on laptops, email and shared drives.
- IndustrySOC 2 for data analytics companiesIngested data, pipelines and what customers can query.
- IndustrySOC 2 for developer toolsSource code, secrets and CI/CD as customer data.
- IndustrySOC 2 for logistics and supply chain softwareShipment data, integrations and partner portals.
09 · AT-C & AICPA standards
The standards behind the report
The AT-C sections, SSAE 18 and the criteria documents a SOC report is issued under.
- StandardsThe AICPA attestation standards, mappedHow SSAE 18, the AT-C sections and the SOC suites fit together.
- StandardsAT-C 105: ideas behind every attestationPractitioner, subject matter, criteria, assertion: the vocabulary of every report.
- StandardsAT-C 205: how an examination is runPlanning, testing and reporting on an examination engagement.
- StandardsAT-C 320: the SOC 1 standardControls at a service organization that touch financial reporting.
- StandardsSSAE 18: what the codification didWhy the standards were recodified, and what changed for service organizations.
- StandardsDC 200: what a system description is measured againstThe description criteria, and how an auditor tests a description.
- StandardsTSP 100: how the criteria document is builtCategories, criteria and points of focus, and why the 2017 set still applies.
10 · SOC 1
SOC 1: the report for your customers' auditors
Controls that touch a client's financial reporting: who needs one, what is inside, and how to get one.
- ComparisonSOC 1 vs SOC 2 vs SOC 3Who asks for each report, how the three differ, and when you need two.
- OverviewSOC 1, explainedWhat a SOC 1 covers, AT-C 320, and bridge letters.
- OverviewWho is who in a SOC 1The service organization, user entities and user auditors, and how a report moves between them.
- OverviewWho needs a SOC 1 report?A test for service providers whose work touches clients' financial statements.
- OverviewSOC 1 Type 1 vs Type 2Design at a date or operation over a period, and what auditors want.
- OverviewSOC 1 or SOC 2: which do you need?A decision path for service providers asked for either.
- OverviewSOC 1 and Sarbanes-OxleyHow a service provider's report feeds a client's SOX work.
- OverviewSOC 1 and ISO 27001A financial-controls report next to a security certificate.
- Technical referenceControl objectives in a SOC 1How to write them, and why they come before the controls.
- Technical referenceICFR and SOC 1 controlsWhich controls matter to a client's financial reporting.
- Technical referenceThe SOC 1 system descriptionWhat the description must say, and how it is tested.
- Technical referenceUser entity controls in a SOC 1What clients must do for your controls to work.
- Technical referenceSubservice organizations in a SOC 1Carve-out or inclusive for the vendors behind your service.
- Technical referenceHow to read a SOC 1 reportThe sections, the opinion, and the exceptions that matter.
- Technical referenceSOC 1 bridge lettersCovering the gap after a period ends, for a client's auditor.
- PlanningPreparing for a SOC 1 examinationWhat to have ready before fieldwork starts.
- PlanningA SOC 1 readiness checklistA working list to test your position before you engage a CPA firm.
- PlanningSOC 1 phases from scoping to reportThe order of work, from scoping to the issued report.
- IndustrySOC 1 for payroll providersCalculation, cut-offs and file transfers a client's auditor tests.
- IndustrySOC 1 for fintech and paymentsMoney movement, reconciliations and settlement.
- IndustrySOC 1 for mortgage and loan servicingPayments, escrow and investor reporting.
- IndustrySOC 1 for BPO and outsourced accountingProcessing on behalf of a client's finance team.
- StandardsAT-C 320: the SOC 1 standardControls at a service organization that touch financial reporting.
11 · SOC 3
SOC 3: the report you can publish
The general-use report on the same criteria as a SOC 2.
Questions about the SOC 2 library
Where should I start if SOC 2 is new to me?
With what SOC 2 is, then Type 1 vs Type 2.
Read What is SOC 2? for the basics, then Type 1 vs Type 2 to choose a report, then the Trust Services Criteria to set your scope. The scope emulator is a quick way to see how your commitments map to categories.
Do these guides replace a readiness assessment?
No. They explain the framework; readiness applies it to you.
The guides explain how SOC 2 works. A readiness assessment reads your actual contracts, systems and evidence, sets your scope, and ranks the gaps for your first report.
Ready to apply it to your own system?
A SOC 2 readiness assessment turns the library into your scope, your gaps and your roadmap.